HashiCorp Terraform Associate (004) Question 192
Single answer7b Use the CLI to inspect stateA team stores Terraform state remotely and has just imported an existing AWS security group into their workspace. Before making any changes, they want to verify exactly which attributes Terraform currently has recorded for that specific resource in state, without opening or editing the raw state file. Which Terraform CLI command is the best choice?
- A
terraform show aws_security_group.web
- B
terraform state list aws_security_group.web
- C
terraform state show aws_security_group.web
- D
terraform output aws_security_group.web
Show answer and explanation
Correct answer: C
Explanation
To inspect the current state of a specific resource instance, use terraform state show <resource_address>. This command is designed for targeted state inspection and is especially useful after imports, troubleshooting drift, or verifying what Terraform has recorded before applying changes. By contrast, terraform state list only enumerates resource addresses, terraform show renders the full state or plan in human-readable form, and terraform output is limited to declared output values. According to Terraform CLI documentation, terraform state show is the correct command for inspecting a single resource in state, while terraform show is broader and not used with a resource address argument in this way.
- A. Incorrect.
Incorrect.
terraform showdisplays a human-readable representation of the entire state or a saved plan file, not a single resource by address passed this way. A common misconception is thatterraform showcan target a resource address directly, but that is not how the command works. - B. Incorrect.
Incorrect.
terraform state listis used to list resource addresses in the state. It can help confirm thataws_security_group.webexists in state, but it does not display the stored attribute values for that resource. Someone might choose this because they associate 'list' with inspection, but it only shows addresses. - C. Correct.
Correct.
terraform state show aws_security_group.webdisplays the attributes Terraform currently has recorded in state for the specified resource address. This is the appropriate CLI command when you need to inspect one managed object in state without interacting with the raw state file directly. - D. Incorrect.
Incorrect.
terraform outputdisplays root module output values, not resource instances stored in state by resource address. This distractor reflects a common misunderstanding that outputs provide direct inspection into any resource tracked by Terraform, which they do not unless explicitly exposed as outputs in configuration.